Skip to content

Bump simpleeval from 0.9.13 to 1.0.0

Ronan Amicel requested to merge dependabot-pip-simpleeval-1.0.0 into main

Bumps simpleeval from 0.9.13 to 1.0.0.

Release notes

Sourced from simpleeval's releases.

1.0.0

What's new in this release?

  • Fix a sandbox escape via generators and _frame methods.
  • Supporting dictionary comprehensions
  • A custom exception rather than KeyError when names not found
  • Dropping support for old python versions - if you need pre 3.9, then you can use an older version
  • Various cleanups & tidying warnings, deprecation warnings etc.

So 1.0 as a 'this is the way it works'. It's been basically stable for years now, I've just never called it that - hopefully now this draws a line in what's possible without breaking changes.

There's lots of ideas to make it better - but that's better as a new 2.x branch with allowing a few breaking changes (mostly for security).

Commits
  • f046223 Merge pull request #144 from danthedeckie/1.0.0
  • 0fe45bb Fix licence & classifier info for pypi
  • eced404 README bump badges
  • 07f3363 Hacky make codecov see new lines are tested.
  • 5c38a5c Bump copyright year.
  • 014f2e8 Merge pull request #126 from danthedeckie/better-names-exceptions
  • ee16fd3 README fixes
  • 983f4e0 Don't misuse KeyError for the custom names function.
  • 166e90f Merge pull request #150 from danthedeckie/dictcomp-support
  • c9dcca1 delint and add contib to README
  • Additional commits viewable in compare view

Merge request reports